Combining REST route RBAC and resource ownership ABAC in one model vs multiple enforcers

Hey all,
I'm struggling to come up with a combined model and policy that works for my usecase, and im wondering if infact I should just have multiple models applied one at a time?
Anyway, I'm aiming for 1) REST route based access, allow by default, certain wildcard paths only allowed by certain groups (RBAC) 2) ABAC access based on the ownership of some resources, and so far I just seem to get into a mess 😄

Yeah, im starting to think multiple enforcers is defintly the way to go...

what's your question?

what you expect and what you got